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The Lunar Reconnaissance Orbiter (LRO), a spacecraft designed and built at the National Aeronautics 
and Space Administration's (NASA) Goddard Space Flight Center (GSFC) in Greenbelt, MD, was launched 
on June 18, 2009 from Cape Canaveral. It is currently in orbit about the Moon taking detailed science 
measurements and providing a highly accurate mapping of the surface in preparation for the future 
return of astronauts to a permanent moon base. Onboard the spacecraft is a complex set of algorithms 
designed by the attitude control engineers at GSFC to control the pointing for all operational events, 
including anomalies that require the spacecraft to be put into a well known attitude configuration for a 
sufficiently long duration to allow for the investigation and correction of the anomaly. GSFC level 
requirements state that each spacecraft's control system design must include a configuration for this 
pointing and also be able to maintain a thermally safe and power positive attitude. This stable control 
algorithm for anomalous events is commonly referred to as the safe mode and consists of control logic 
that will put the spacecraft in this safe configuration defined by the spacecraft's hardware, power and 
environment capabilities and limitations. 

The LRO Sun Safe mode consists of a coarse sun-pointing set of algorithms that puts the spacecraft into 
this thermally safe and power positive attitude and can be achieved within a required amount of time 
from any initial attitude, provided that the system momentum is within the momentum capability of the 
reaction wheels. On LRO the Sun Safe mode makes use of coarse sun sensors (CSS), an inertial reference 
unit (IRU) and reaction wheels (RW) to slew the spacecraft to a solar inertial pointing. The CSS and 
reaction wheels have some level of redundancy because of their numbers. Flowever, the IRU is a single- 
point-failure piece of hardware. Without the rate information provided by the IRU, the Sun Safe control 
algorithms could not maintain the required pointing, so a sub-mode of the Sun Safe mode that does not 
use the IRU was designed. This submode, referred to as the Sun Safe Gyroless control mode, consists of 
an algorithm that estimates rate information from the CSS and the RW measurements. RW momentum 
information is used to estimate the body rate parallel to the target sunline, which CSS alone would not 
be able to observe. Sun Safe can be autonomously, or via ground command, entered from any other 
control mode and in the event the IRU is not providing rate information, the control mode is switched to 
the gyroless submode. 

This paper looks at the design of the Sun Safe modes and discusses the constraints placed on the 
algorithm and how the mode worked around these constraints. Items of particular interest include CSS 
placement on the Solar Array (SA) and its implications to design, estimation of body rate information for 
the Sun Safe Gyroless control mode, and the effect of solar eclipse on each of the Sun Safe modes. 
Placing CSS on the SA was necessary for the means to put the Sun along the targeted sun-line, nominally 
normal to the SA panels, for all operational considerations. This had design implications for determining 
a sun vector during normal SA operations, if one or both gimbals become inoperable and when the SA is 
in a stowed configuration. The ability of body rate estimation in Sun Safe Gyroless not only uses CSS sun 
vector data but requires RW momentum measurements to estimate rates parallel to the sun-line. LRO 



encounters solar eclipses of some length for most of its orbits about the Moon. With the lack of CSS 
measurement data a design was implemented in both Sun Safe and Sun Safe Gyroless, they differ 
because of having or not having IRU measurement data, to carry the spacecraft through these eclipse 
periods. This paper also includes some discussion of sun avoidance and how it affected design decisions 
during nominal and eclipse periods for each of the Sun Safe modes. 

Although the Sun Safe Gyroless control algorithms have not as yet been exercised, there have been a 
few occasions in which the Sun Safe control mode has been entered. The first occasion was planned as it 
was the initial attitude acquisition immediately after separation from the launch vehicle, which also 
served to absorb tip-off rates from separation, provided they were within wheel capabilities. The others 
were due to operational errors when creating scripts that omitted disabling a watch point, causing the 
Failure Detection and Correction logic to trip and resulted in the mode transition to Sun Safe. These 
excursions into Sun Safe will be examined to determine how well the control mode performed relative 
to design implemented and requirements placed on it. 



